Transcript Unit OS3: Advanced Windows Synchronization

Unit OS3: Concurrency
3.3. Advanced Windows Synchronization
Windows Operating System Internals - by David A. Solomon and Mark E. Russinovich with Andreas Polze
Copyright Notice
© 2000-2005 David A. Solomon and Mark Russinovich
These materials are part of the Windows Operating
System Internals Curriculum Development Kit,
developed by David A. Solomon and Mark E.
Russinovich with Andreas Polze
Microsoft has licensed these materials from David
Solomon Expert Seminars, Inc. for distribution to
academic organizations solely for use in academic
environments (and not for commercial use)
2
Roadmap for Section 3.3.
Deferred and Asynchronous Procedure Calls
IRQLs and CPU Time Accounting
Wait Queues & Dispatcher Objects
3
Deferred Procedure Calls (DPCs)
Used to defer processing from higher (device) interrupt level to a lower
(dispatch) level
Also used for quantum end and timer expiration
Driver (usually ISR) queues request
One queue per CPU. DPCs are normally queued to the current
processor, but can be targeted to other CPUs
Executes specified procedure at dispatch IRQL (or “dispatch level”, also
“DPC level”) when all higher-IRQL work (interrupts) completed
Maximum times recommended: ISR: 10 usec, DPC: 25 usec
See http://www.microsoft.com/whdc/driver/perform/mmdrv.mspx
queue head
DPC object
DPC object
DPC object
4
Delivering a DPC
DPC routines can‘t
assume what
process address
space is currently
mapped
DPC
1. Timer expires, kernel
queues DPC that will
release all waiting threads
Kernel requests SW int.
Interrupt
dispatch table
high
Power failure
2. DPC interrupt occurs
when IRQL drops below
dispatch/DPC level
DPCDPC DPC
DPC queue
DPC routines can call kernel functions
but can‘t call system services, generate
page faults, or create or wait on objects
3. After DPC interrupt,
control transfers to
thread dispatcher
Dispatch/DPC
APC
Low
dispatcher
4. Dispatcher executes each DPC
routine in DPC queue
5
Asynchronous Procedure Calls
(APCs)
Execute code in context of a particular user thread
APC routines can acquire resources (objects), incur page faults,
call system services
APC queue is thread-specific
User mode & kernel mode APCs
Permission required for user mode APCs
Executive uses APCs to complete work in thread space
Wait for asynchronous I/O operation
Emulate delivery of POSIX signals
Make threads suspend/terminate itself (env. subsystems)
APCs are delivered when thread is in alertable wait state
WaitForMultipleObjectsEx(), SleepEx()
6
Asynchronous Procedure Calls
(APCs)
Special kernel APCs
Run in kernel mode, at IRQL 1
Always deliverable unless thread is already at IRQL 1 or above
Used for I/O completion reporting from “arbitrary thread context”
Kernel-mode interface is linkable, but not documented
“Ordinary” kernel APCs
Always deliverable if at IRQL 0, unless explicitly disabled
(disable with KeEnterCriticalRegion)
User mode APCs
Used for I/O completion callback routines (see ReadFileEx, WriteFileEx); also,
QueueUserApc
Only deliverable when thread is in “alertable wait”
Thread
Object
K
APC objects
U
7
IRQLs and CPU Time Accounting
Interval clock timer ISR keeps track of time
Clock ISR time accounting:
If IRQL<2, charge to thread’s user or kernel time
If IRQL=2 and processing a DPC, charge to DPC time
If IRQL=2 and not processing a DPC, charge to thread kernel time
If IRQL>2, charge to interrupt time
Since time servicing interrupts are NOT charged to interrupted
thread, if system is busy but no process appears to be running, must
be due to interrupt-related activity
Note: time at IRQL 2 or more is charged to the current thread’s
quantum (to be described)
8
Interrupt Time Accounting
Task Manager includes interrupt and DPC time with the Idle
process time
Since interrupt activity is not charged to any thread or process,
Process Explorer shows these as separate processes (not really
processes)
Context switches for these are really number of interrupts and DPCs
9
Time Accounting Quirks
Looking at total CPU time for each process may not reveal where
system has spent its time
CPU time accounting is driven by programmable interrupt timer
Normally 10 msec (15 msec on some MP Pentiums)
Thread execution and context switches between clock intervals NOT
accounted
E.g., one or more threads run and enter a wait state before clock fires
Thus threads may run but never get charged
View context switch activity with Process Explorer
Add Context Switch Delta column
10
Looking at Waiting Threads
For waiting threads, user-mode utilities only display the wait reason
Example: pstat
To find out what a thread is waiting on, must use kernel debugger
11
Wait Internals 1:
Dispatcher Objects
Any kernel object you can wait for is a “dispatcher object”
some exclusively for synchronization
e.g. events, mutexes (“mutants”), semaphores, queues, timers
others can be waited for as a side effect of their prime function
e.g. processes, threads, file objects
non-waitable kernel objects are called “control objects”
All dispatcher objects have a common header
All dispatcher objects are in one of two states
“signaled” vs. “nonsignaled”
Dispatcher
Object
when signalled, a wait on the object is satisfied
Size
Type
State
different object types differ in terms of what changes
their state
Wait listhead
wait and unwait implementation is
common to all types of dispatcher objects
Object-typespecific data
(see \ntddk\inc\ddk\ntddk.h)
12
Thread Objects
Wait Internals 2:
Wait Blocks
WaitBlockList
WaitBlockList
Dispatcher
Objects
Represent a thread’s reference to
something it’s waiting for (one per handle
passed to WaitFor…)
All wait blocks from a given wait call are
chained to the waiting thread
Size
Type
State
Wait blocks
Wait listhead
List entry
Object-typespecific data
Thread
Object
Key
Type
Next link
Type indicates wait for “any” or “all”
Key denotes argument list position for
WaitForMultipleObjects
Size
Type
State
Wait listhead
List entry
List entry
Object-typespecific data
Thread
Object
Key
Type
Next link
Thread
Object
Key
Type
Next link
13
Further Reading
Mark E. Russinovich and David A. Solomon,
Microsoft Windows Internals, 4th Edition,
Microsoft Press, 2004.
Chapter 3 - System Mechanisms
Kernel Event Tracing (from pp. 175)
DPC Interrupts (from pp. 104)
14